MFA fatigue

An attack in which someone who already has a user's password repeatedly triggers MFA push prompts, hoping the user approves one out of annoyance or confusion. Defenses include number-matching push or phishing-resistant MFA, conditional access rules that block sign-ins from unexpected locations or devices, and telling staff to deny and report any approval request they did not start themselves.

Further reading: attack.mitre.org

All terms